CVE-2024-43845: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-43845 affects the Linux kernel's UDF (Universal Disk Format) filesystem implementation. The vulnerability was discovered by Syzbot and involves uninitialized memory access in the udf_rename() function when updating the checksum of '..' directory entry of a moved directory. The issue affects Linux kernel versions from 6.3 up to (excluding) 6.6.44 and from 6.7 up to (excluding) 6.10.3 (NVD).

The vulnerability occurs because the code passes on-stack diriter.fi to the udfupdatetag() function, which contains only the struct fileIdentDesc but not the impUse or name fields. This causes the checksumming function to checksum random stack contents beyond the end of the structure. The issue has been assigned a CVSS v3.1 base score of 3.3 (LOW) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability's impact is considered low as the issue is actually harmless. This is because the following udffiiterwrite_fi() function will recompute the checksum from on-disk buffers where everything is properly included (Kernel Patch).

The issue has been fixed by removing the bogus checksum calculation in the udf_rename() function. The fix has been implemented in multiple kernel versions through patches. Users should update their Linux kernel to versions 6.6.44, 6.10.3 or later to receive the fix (NVD).